commit cfb9bbf2e3e88b86cf8e86e4bbdfe7e26c9cd997
parent 1d51066089ac2808424d3aead05cce752aa56516
Author: mtmn <miro@haravara.org>
Date: Mon, 13 Apr 2026 17:49:27 +0200
cleanup
Diffstat:
11 files changed, 12 insertions(+), 34 deletions(-)
diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,3 @@
+static/mtmn
hosts.nix
result
diff --git a/flake.lock b/flake.lock
@@ -100,6 +100,7 @@
"original": {
"owner": "serokell",
"repo": "deploy-rs",
+ "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
"type": "github"
}
},
diff --git a/flake.nix b/flake.nix
@@ -15,7 +15,7 @@
};
deploy-rs = {
- url = "github:serokell/deploy-rs";
+ url = "github:serokell/deploy-rs/77c906c0ba56aabdbc72041bf9111b565cdd6171";
inputs.nixpkgs.follows = "nixpkgs";
};
@@ -67,13 +67,10 @@
nix.settings = {
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
- netrc-file = "/run/agenix/netrc";
};
}
inputs.ragenix.nixosModules.default
@@ -106,11 +103,9 @@
nix.settings = {
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
}
@@ -166,19 +161,16 @@
"couchdb"
"oauth2-proxy"
"storage-box"
- "bazel-cache"
"shirt-linkener"
"bandeno"
"headscale"
"searxng"
- "attic"
"static"
"miniflux"
"corpus"
"corpus-pstmn"
"napkins"
"listenbrainz-mpd"
- "redlib"
]
importService
// {
diff --git a/home.nix b/home.nix
@@ -43,13 +43,10 @@
experimental-features = ["nix-command" "flakes"];
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
- netrc-file = "${homeDirectory}/.netrc";
};
gc = {
automatic = true;
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/justfile b/justfile
@@ -12,7 +12,7 @@ deadnix:
deploy host="nixaran":
@backup nix
- nix run --fallback github:serokell/deploy-rs .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
+ nix run --inputs-from . github:serokell/deploy-rs .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
update:
nix flake update
@@ -21,7 +21,7 @@ install host:
./hack/install_anywhere {{ host }}
diff host="nixaran":
- nix run github:serokell/deploy-rs -- --dry-activate .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
+ nix run --inputs-from . github:serokell/deploy-rs -- --dry-activate .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
local:
nh home switch "$(git rev-parse --show-toplevel)"
diff --git a/modules/nixos/base.nix b/modules/nixos/base.nix
@@ -13,12 +13,10 @@
substituters = [
"https://cache.nixos.org"
"https://nix-community.cachix.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
gc = {
@@ -26,7 +24,6 @@
dates = "weekly";
options = "--delete-older-than 30d";
};
- # Pin nixpkgs to the flake version for consistency
registry.nixpkgs.flake = inputs.nixpkgs;
};
diff --git a/modules/services/attic.nix b/modules/services/attic.nix
@@ -30,6 +30,10 @@ in {
type = lib.types.path;
description = "Path to environment file with ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64 and AWS credentials";
};
+ signingKeyFile = lib.mkOption {
+ type = lib.types.path;
+ description = "Path to the Nix signing private key file (generated with nix-store --generate-binary-cache-key)";
+ };
port = lib.mkOption {
type = lib.types.port;
default = 7381;
@@ -56,6 +60,9 @@ in {
endpoint = cfg.s3Endpoint;
region = cfg.s3Region;
};
+ signing = {
+ signing-key-paths = [cfg.signingKeyFile];
+ };
};
environmentFile = cfg.credentialsFile;
};
diff --git a/modules/services/storage-box.nix b/modules/services/storage-box.nix
@@ -69,9 +69,6 @@ in {
++ lib.optionals config.services.haravara.monitoring.enable [
"d ${cfg.mountPoint}/nixaran/victoriametrics - - - -"
]
- ++ lib.optionals config.services.haravara.bazel-cache.enable [
- "d ${cfg.mountPoint}/nixaran/bazel-cache 0750 bazel-remote bazel-remote -"
- ]
++ lib.optionals config.services.haravara.seaweedfs.enable [
"d ${cfg.mountPoint}/seanix 0755 seaweedfs storage-users -"
"d ${cfg.mountPoint}/seanix/master 0755 seaweedfs storage-users -"
@@ -118,14 +115,6 @@ in {
options = ["bind" "nofail"];
depends = [cfg.mountPoint];
};
- }
- // lib.optionalAttrs config.services.haravara.bazel-cache.enable {
- "/var/lib/bazel-cache" = {
- device = "${cfg.mountPoint}/nixaran/bazel-cache";
- fsType = "none";
- options = ["bind" "nofail" "_netdev"];
- depends = ["${cfg.mountPoint}"];
- };
};
systemd.services = let
@@ -151,10 +140,6 @@ in {
victoriametrics.after = ["var-lib-victoriametrics.mount"];
victoriametrics.requires = ["var-lib-victoriametrics.mount"];
})
- (lib.mkIf config.services.haravara.bazel-cache.enable {
- bazel-remote.after = ["var-lib-bazel\\x2dcache.mount"];
- bazel-remote.requires = ["var-lib-bazel\\x2dcache.mount"];
- })
];
};
}
diff --git a/secrets.nix b/secrets.nix
@@ -12,12 +12,10 @@ in {
"secrets/couchdb-admin-pass.age".publicKeys = allKeys;
"secrets/searx-secret-key.age".publicKeys = allKeys;
"secrets/headscale-api-key.age".publicKeys = allKeys;
- "secrets/attic-credentials.age".publicKeys = allKeys;
"secrets/miniflux-secrets.age".publicKeys = allKeys;
"secrets/listenbrainz-token.age".publicKeys = allKeys;
"secrets/mpd-host.age".publicKeys = allKeys;
"secrets/scorpus.age".publicKeys = allKeys;
"secrets/corpus.age".publicKeys = allKeys;
"secrets/corpus-pstmn.age".publicKeys = allKeys;
- "secrets/netrc.age".publicKeys = allKeys;
}
diff --git a/secrets/attic-credentials.age b/secrets/attic-credentials.age
Binary files differ.
